In recent days, two critical PHP vulnerabilities, known as PHP2Shell and identified as CVE-2026-109618 and CVE-2026-109619, have received considerable attention in the PHP community.
More information about these vulnerabilities is available on the official PHP website:
These vulnerabilities have had a significant impact on environments running PHP. Administrators using affected PHP versions have been urged to update their installations as soon as possible.
The vulnerabilities have been addressed in the following PHP versions:
- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35
Both the PHP team and package maintainers across many Linux distributions have done an excellent job. Thanks to the early distribution of security fixes to operating system vendors, updated PHP packages were often available on the same day the vulnerabilities were publicly disclosed.
These developments have also affected web applications used with Bacula. On October 24, Davide Franco, the maintainer of the Bacula-Web project, announced the release of version 10.0.2. In this release, the official Docker image was updated to PHP 8.5.12, which includes fixes for the reported vulnerabilities.
It is worth noting that this security update concerns the container environment in which Bacula-Web runs, rather than the Bacula-Web application code itself. The PHP version used in the project's official Docker image has been updated to include the security fixes.
In addition to the PHP update, Bacula-Web 10.0.2 fixes support for custom database connection ports when connecting to the Bacula Catalog database.
In the release notes, Davide strongly recommends updating PHP as soon as possible and encourages Bacula-Web users to upgrade to the latest release. He repeated his recommendation in an announcement on the Bacula-Users mailing list, where he also encouraged users to actively participate in the Bacula-Web project.
Similar efforts have also been seen in other Bacula-related projects in recent days. These include updates to both official and community-maintained Bacularis container images.
Bacula News would like to thank the PHP project, the security researchers who discovered the vulnerabilities, package maintainers, Davide, and everyone else whose work made these important PHP security fixes available so quickly. Thanks to their efforts, users have been able to promptly deploy updates addressing these critical vulnerabilities.